evolcore 0.0.23 → 0.0.24

package/dist/agents/codex-runner.js

@@ -5,10 +5,10 @@ import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/permission/protected-paths.js';
 import { CODEX_THREAD_ACTIVE_WRITER, CodexAppServerClient, } from './codex/app-server-client.js';
-import { resolveOpenaiConfig } from './baseagent.js';
+import { resolveOpenaiConfig, resolveCodexCliPath } from './baseagent.js';
 import { logger } from '../utils/logger.js';
 import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
-import { auditCodexApprovalDecision, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
+import { auditCodexApprovalDecision, auditPermissionLifecycle, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { isRetryableError } from '../utils/error-utils.js';
 import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from '../core/message/message-utils.js';
@@ -17,11 +17,12 @@ import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/au
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
 import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, hasCodexCmdCarrierEcIntent, hasPowerShellDelegationAssignment, normalizeEvolcoreCommandArgv, parseCodexToolCommand, parseCodexCarrierCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
-import { resolvePaths, resolveRoot } from '../paths.js';
+import { agentSessionsDir, resolvePaths, resolveRoot } from '../paths.js';
 import { ensureProcessManagedTempDir, getManagedTaskTempDir } from '../cli/task-context.js';
 import { buildSessionTurnList } from '../core/session/session-turns.js';
+import { CodexSessionFileAdapter } from '../core/session/adapters/codex-session-file-adapter.js';
 import { execFileSync } from 'child_process';
-import { execCodexCliSync, resolveCodexCliPath } from '../utils/codex-cli.js';
+import { probeCli, probeCliSync } from '../utils/cross-platform.js';
 import { createHash, randomBytes } from 'crypto';
 import { buildModelRequestHeaders } from './request-identity.js';
 import fs from 'fs';
@@ -41,6 +42,13 @@ export function formatApprovalLogSummary(summary) {
         return singleLine;
     return singleLine.slice(0, APPROVAL_LOG_SUMMARY_MAX_LENGTH - 3).trimEnd() + '...';
 }
+/**
+ * 规范化模型 ID：去掉 Claude Code SDK 专有的上下文窗口后缀 [1m]/[200k]
+ * Codex/OpenAI API 不认识这些后缀，必须传入标准模型 ID
+ */
+function stripContextWindowSuffix(modelId) {
+    return modelId.replace(/\[(?:1m|200k)\]$/i, '');
+}
 // ── Codex 模型目录（动态获取，含 effort） ──
 class AsyncEventQueue {
     queue = [];
@@ -89,6 +97,11 @@ function errorCodeForToolDenial(decisionSource, policyCode) {
         return 'INVALID_ARGUMENT';
     return 'EXECUTION_FAILED';
 }
+function isCodexReasoningNotification(method) {
+    return method === 'item/reasoning/textDelta'
+        || method === 'item/reasoning/summaryTextDelta'
+        || method === 'item/reasoning/summaryPartAdded';
+}
 const CODEX_THREAD_HANDOFF_TIMEOUT_MS = 2_000;
 const managedTempDirsForExitCleanup = new Map();
 let managedTempExitCleanupRegistered = false;
@@ -235,21 +248,59 @@ export function parseCodexCliVersion(output) {
 export function isCodexCliVersionSupported(version) {
     return compareVersions(version, MIN_CODEX_CLI_VERSION) >= 0;
 }
+// Windows shim/process startup can exceed the quick probe deadline under load.
+const CODEX_CLI_PROBE_TIMEOUT_MS = 3000;
+const CODEX_CLI_PROBE_RETRY_TIMEOUT_MS = 15_000;
+function compactCodexProbeText(value, maxLength = 600) {
+    if (Buffer.isBuffer(value))
+        value = value.toString('utf-8');
+    if (typeof value !== 'string')
+        return undefined;
+    const text = value.replace(/\s+/gu, ' ').trim();
+    return text.length <= maxLength ? text : `${text.slice(0, maxLength - 3).trimEnd()}...`;
+}
+function logCodexProbeFailure(args, startedAt, error, timeoutMs) {
+    const detail = error;
+    logger.warn(`[CodexProbe] CLI probe failed: ${JSON.stringify({
+        command: ['codex', ...args],
+        path: detail?.path ?? null,
+        spawnargs: detail?.spawnargs ?? null,
+        elapsedMs: Date.now() - startedAt,
+        timeoutMs,
+        code: detail?.code ?? null,
+        status: detail?.status ?? null,
+        signal: detail?.signal ?? null,
+        timedOut: detail?.code === 'ETIMEDOUT',
+        message: compactCodexProbeText(detail?.message ?? String(error)),
+        stdout: compactCodexProbeText(detail?.stdout),
+        stderr: compactCodexProbeText(detail?.stderr),
+    })}`);
+}
+function probeCodexCli(args) {
+    return probeCliSync('codex', args, { onFailure: logCodexProbeFailure });
+}
 export function getCodexCliVersion() {
+    const startedAt = Date.now();
     try {
-        const output = execCodexCliSync(['--version'], {
-            encoding: 'utf-8',
-            timeout: 3000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        return parseCodexCliVersion(output);
+        const output = probeCodexCli(['--version']);
+        const version = parseCodexCliVersion(output);
+        if (!version) {
+            logCodexProbeFailure(['--version'], startedAt, {
+                code: 'INVALID_VERSION_OUTPUT',
+                message: 'Codex CLI version output could not be parsed',
+                status: 0,
+                stdout: output,
+            }, CODEX_CLI_PROBE_TIMEOUT_MS);
+        }
+        return version;
     }
     catch {
         return null;
     }
 }
 export function getCodexAppServerAvailability() {
-    if (!resolveCodexCliPath()) {
+    const cliPath = resolveCodexCliPath();
+    if (!cliPath) {
         return { available: false, reason: '未检测到 Codex CLI。' };
     }
     const version = getCodexCliVersion();
@@ -265,21 +316,45 @@ export function getCodexAppServerAvailability() {
         };
     }
     try {
-        execCodexCliSync(['app-server', '--help'], {
-            encoding: 'utf-8',
-            timeout: 3000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        probeCodexCli(['app-server', '--help']);
         return { available: true, version };
     }
-    catch {
-        return { available: false, version, reason: `Codex CLI ${version} 不支持 app-server。` };
+    catch (error) {
+        if (error?.code === 'ETIMEDOUT') {
+            return { available: false, version, reason: `Codex CLI ${version} 的 app-server 探测超时，请稍后重试。` };
+        }
+        return { available: false, version, reason: `Codex CLI ${version} 的 app-server 探测失败，请检查 CLI 启动日志。` };
     }
 }
 export function isCodexAppServerAvailable() {
     return getCodexAppServerAvailability().available;
 }
-// ── Codex Runner ──
+/** Daemon startup/hot reload use asynchronous probes; sync CLI callers share the cache. */
+export async function getCodexAppServerAvailabilityAsync() {
+    const options = {
+        timeouts: [CODEX_CLI_PROBE_TIMEOUT_MS, CODEX_CLI_PROBE_RETRY_TIMEOUT_MS],
+        onFailure: logCodexProbeFailure,
+    };
+    let version;
+    try {
+        version = parseCodexCliVersion(await probeCli('codex', ['--version'], options)) ?? undefined;
+        if (!version)
+            return { available: false, reason: '无法读取 Codex CLI 版本。' };
+        if (!isCodexCliVersionSupported(version)) {
+            return { available: false, version, requiresUpgrade: true,
+                reason: `Codex CLI ${version} 低于最低要求 ${MIN_CODEX_CLI_VERSION}。请升级 Codex CLI：npm install -g @openai/codex@latest` };
+        }
+        await probeCli('codex', ['app-server', '--help'], options);
+        return { available: true, version };
+    }
+    catch (error) {
+        const detail = error;
+        return { available: false, version, reason: detail.code === 'ETIMEDOUT' || detail.killed
+                ? 'Codex CLI 探测超时，请稍后重试。'
+                : `Codex CLI 探测失败：${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+export const CODEX_SESSION_TOKEN_ENV = 'EVOLCORE_CODEX_SESSION_TOKEN';
 export class CodexRunner {
     name = 'codex';
     // turn/start persists a new user turn before runQuery resolves. App-server
@@ -291,7 +366,7 @@ export class CodexRunner {
     activeAbortControllers = new Map();
     activeStreams = new Map();
     activeSessions = new Map(); // sessionId → threadId
-    /** Threads created/resumed for a turn but not yet durably admitted by turn/start. */
+    /** New threads held in memory until the exact first turn is visible in the rollout. */
     provisionalSessions = new Map();
     activeTurns = new Map();
     activeSubagentTurns = new Map();
@@ -320,8 +395,14 @@ export class CodexRunner {
     permissionGateway;
     sendPromptFn;
     permissionContexts = new Map();
+    /** Fallback authorization lifecycle ids for app-server requests without an RPC id. */
+    approvalLifecycleIds = new WeakMap();
     resolvedConfig;
     pendingInterruptTtlMs = 30_000;
+    /** Fallback for direct runner callers that do not inject SessionManager. */
+    codexSessionFileAdapter = new CodexSessionFileAdapter();
+    /** threadId → managed-hook credential, issued by this runner's agent only. */
+    threadCredentials = new Map();
     constructor(config, callbacks, runtime) {
         // Compatibility for legacy direct callers that still pass the removed
         // internal fields in a synthetic config. AgentLoader uses runtime binding.
@@ -350,7 +431,7 @@ export class CodexRunner {
             fileRewind: 'git-head',
             fullaccess: true,
         };
-        this.model = this.resolvedConfig.model;
+        this.model = stripContextWindowSuffix(this.resolvedConfig.model);
         if (this.resolvedConfig.effort)
             this.effort = this.resolvedConfig.effort;
         this.onSessionIdUpdate = callbacks.onSessionIdUpdate;
@@ -775,6 +856,11 @@ export class CodexRunner {
             error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
             throw error;
         }
+        // The binding callback can yield while a replacement run claims this
+        // session. Re-check the provisional owner before publishing any local
+        // indexes so a late first turn cannot overwrite the newer thread.
+        if (this.provisionalSessions.get(sessionId) !== threadId)
+            return false;
         this.provisionalSessions.delete(sessionId);
         this.activeSessions.set(sessionId, threadId);
         if (carrierToPublish) {
@@ -784,6 +870,30 @@ export class CodexRunner {
         this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         return true;
     }
+    async waitForCodexTurnPersistence(sessionManager, projectPath, threadId, turnId, timeoutMs = 0) {
+        const check = () => {
+            try {
+                if (typeof sessionManager?.checkSessionTurnPersisted === 'function') {
+                    return sessionManager.checkSessionTurnPersisted(projectPath, threadId, 'codex', turnId, this.resolvedConfig.agentAid) === true;
+                }
+                return this.codexSessionFileAdapter.checkTurnPersisted(projectPath, threadId, turnId, this.resolvedConfig.agentAid);
+            }
+            catch (error) {
+                logger.debug(`[CodexRunner] rollout persistence check failed: session=${threadId} turn=${turnId} `
+                    + `error=${error instanceof Error ? error.message : String(error)}`);
+                return false;
+            }
+        };
+        const deadline = Date.now() + Math.max(0, timeoutMs);
+        while (true) {
+            if (check())
+                return true;
+            const remaining = deadline - Date.now();
+            if (remaining <= 0)
+                return false;
+            await new Promise(resolve => setTimeout(resolve, Math.min(10, remaining)));
+        }
+    }
     cleanupProvisionalThread(sessionId, threadId) {
         if (this.provisionalSessions.get(sessionId) !== threadId)
             return;
@@ -1094,7 +1204,7 @@ export class CodexRunner {
         }
     }
     // ── ModelSwitcher ──
-    setModel(model) { this.model = model; this.resetAppServerClient(); }
+    setModel(model) { this.model = stripContextWindowSuffix(model); this.resetAppServerClient(); }
     getModel() { return this.model; }
     getModelCatalog() {
         return getRunnerCatalog('codex', this.resolvedConfig.agentAid, this.resolvedConfig);
@@ -1315,7 +1425,28 @@ export class CodexRunner {
         }
         await appServer.assertManagedHooksAvailable();
     }
-    async evaluatePreToolUse(threadId, toolName, toolInput, signal, callId) {
+    /**
+     * Decide whether the managed hook may proceed with a tool call.
+     *
+     * Credential contract (see CODEX_SESSION_TOKEN_ENV):
+     * - sessionToken present and issued by this runner for this thread → the
+     *   call belongs to an EvolCore-managed thread; full policy evaluation.
+     * - sessionToken present but unknown/mismatched → forgery or stale state;
+     *   fail closed with applicable=true so no other outcome allows it.
+     * - sessionToken absent → unmanaged process; not this runner's concern
+     *   (applicable=false; the IPC layer allows such calls outright).
+     */
+    async evaluatePreToolUse(threadId, toolName, toolInput, signal, callId, sessionToken) {
+        if (typeof sessionToken === 'string' && sessionToken) {
+            if (!this.validateThreadCredential(threadId, sessionToken)) {
+                return {
+                    ok: false,
+                    applicable: true,
+                    decision: 'deny',
+                    reason: 'Codex session credential was not recognized',
+                };
+            }
+        }
         const sessionKey = this.findSessionKeyByThread(threadId);
         const activeThread = this.activeSessions.get(sessionKey) ?? this.provisionalSessions.get(sessionKey);
         const context = this.permissionContexts.get(sessionKey);
@@ -1363,6 +1494,16 @@ export class CodexRunner {
             }
         };
         if (!activeThread || !this.isThreadOwnedBySession(sessionKey, threadId)) {
+            if (typeof sessionToken === 'string' && sessionToken) {
+                // A credentialed thread this runner cannot place (e.g. resumed state
+                // lost across a runner reload) must never fall through to allow.
+                return {
+                    ok: false,
+                    applicable: true,
+                    decision: 'deny',
+                    reason: 'EvolCore-managed Codex thread is not tracked by an active session',
+                };
+            }
             return { ok: true, applicable: false };
         }
         const proactiveSession = context?.chatmode === 'proactive';
@@ -1603,7 +1744,7 @@ export class CodexRunner {
             }
         }
         let resumingThread = !!agentSessionId;
-        const callModel = modelOverride?.model || this.model;
+        const callModel = stripContextWindowSuffix(modelOverride?.model || this.model);
         const callEffort = modelOverride?.effortMode === 'model_default'
             ? undefined
             : modelOverride?.effort ?? this.effort;
@@ -1647,7 +1788,7 @@ export class CodexRunner {
             approvalPolicy: effectiveApprovalPolicy,
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined), this.buildLifecycleLockdownConfig(callMode)), callMode),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined, agentSessionId), this.buildLifecycleLockdownConfig(callMode)), callMode),
             ...(developerInstructions ? { developerInstructions } : {}),
         };
         logger.info(`[CodexRunner] runQuery permMode=${requestedPermissionMode}->${callMode} ` +
@@ -1690,6 +1831,7 @@ export class CodexRunner {
                     this.threadDelegationCarriers.delete(missingThreadId);
                     this.unbindExternalToolBoundary(missingThreadId);
                     this.clearTrackedApprovalItemsForThread(missingThreadId);
+                    this.dropThreadCredential(missingThreadId);
                     agentSessionId = undefined;
                     resumingThread = false;
                     knownDelegationCarrier = undefined;
@@ -1795,6 +1937,7 @@ export class CodexRunner {
             projectPath,
             model: callModel,
             committed: resumingThread,
+            persistenceFinalized: resumingThread,
             streamedAgentMessageIds: new Set(),
             agentMessageDeltaText: new Map(),
             completedItemIds: new Set(),
@@ -1834,8 +1977,9 @@ export class CodexRunner {
                     this.unregisterChildThread(notifThreadId);
                     this.endAppServerQueueWhenSubagentsDone(queue, state);
                 }
-                if (this.isSubagentActivityItem(item))
+                if (this.isSubagentActivityItem(item) || isCodexReasoningNotification(notification.method)) {
                     queue.push(notification);
+                }
                 if (notification.method === 'item/completed' && state.turnCompleted) {
                     this.endAppServerQueueWhenSubagentsDone(queue, state);
                 }
@@ -1882,11 +2026,43 @@ export class CodexRunner {
                 ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
             });
             if (!resumingThread) {
-                state.commitProvisional = async () => {
-                    const committed = await this.commitProvisionalThread(sessionId, threadId, carrierToPublish, sessionManager, turn);
-                    if (committed)
-                        agentSessionId = threadId;
-                    return committed;
+                let confirmationInFlight;
+                state.confirmProvisional = (waitMs = 0) => {
+                    if (state.committed)
+                        return Promise.resolve(true);
+                    if (state.persistenceFinalized)
+                        return Promise.resolve(false);
+                    if (confirmationInFlight)
+                        return confirmationInFlight;
+                    const providerTurnId = state.turnId;
+                    if (!providerTurnId)
+                        return Promise.resolve(false);
+                    const confirmation = (async () => {
+                        const persisted = await this.waitForCodexTurnPersistence(sessionManager, projectPath, threadId, providerTurnId, waitMs);
+                        if (!persisted)
+                            return false;
+                        try {
+                            const committed = await this.commitProvisionalThread(sessionId, threadId, carrierToPublish, sessionManager, turn);
+                            if (!committed) {
+                                const staleError = new Error('Codex provisional thread was superseded before persistence confirmation');
+                                staleError.code = 'RUNNER_START_SUPERSEDED';
+                                throw staleError;
+                            }
+                            agentSessionId = threadId;
+                            state.committed = true;
+                            return true;
+                        }
+                        catch (error) {
+                            state.persistenceFinalized = true;
+                            throw error;
+                        }
+                    })();
+                    confirmationInFlight = confirmation;
+                    void confirmation.finally(() => {
+                        if (confirmationInFlight === confirmation)
+                            confirmationInFlight = undefined;
+                    }).catch(() => undefined);
+                    return confirmation;
                 };
             }
             const turnId = turnResponse.turn?.id;
@@ -1894,6 +2070,12 @@ export class CodexRunner {
                 state.turnId = turnId;
                 this.activeTurns.set(sessionId, { threadId, turnId });
             }
+            if (!resumingThread && turnId) {
+                // Check immediately, but leave a just-created rollout as a candidate.
+                // Subsequent notifications recheck it and the terminal boundary gets
+                // the short settle window below.
+                await state.confirmProvisional?.(0);
+            }
             if (turnId && this.consumePendingInterrupt(sessionId)) {
                 await this.interruptAppServerTurn(threadId, turnId);
                 controller.abort('User interrupt');
@@ -2042,11 +2224,16 @@ export class CodexRunner {
         }
         capturedController?.abort('Session closed');
         const capturedSubscription = capturedThreadId ? this.threadSubscriptions.get(capturedThreadId) : undefined;
+        const currentActiveThreadId = this.activeSessions.get(sessionId);
+        const currentProvisionalThreadId = this.provisionalSessions.get(sessionId);
+        const capturedThreadIds = new Set([capturedThreadId, capturedProvisionalThreadId].filter((value) => value !== undefined));
+        const threadLifecycleReplaced = (currentActiveThreadId !== undefined && !capturedThreadIds.has(currentActiveThreadId))
+            || (currentProvisionalThreadId !== undefined && !capturedThreadIds.has(currentProvisionalThreadId));
         const lifecycleReplaced = (capturedStream !== undefined && this.activeStreams.get(sessionId) !== capturedStream)
             || (capturedController !== undefined && this.activeAbortControllers.get(sessionId) !== capturedController)
             || (capturedTurn !== undefined && this.activeTurns.get(sessionId) !== capturedTurn)
             || (capturedPermissionContext !== undefined && this.permissionContexts.get(sessionId) !== capturedPermissionContext)
-            || (capturedThreadId !== undefined && this.activeSessions.get(sessionId) !== capturedThreadId);
+            || threadLifecycleReplaced;
         if (capturedSubscription && !lifecycleReplaced
             && this.threadSubscriptions.get(capturedThreadId) === capturedSubscription) {
             await this.releaseThreadSubscription(capturedSubscription.client, capturedThreadId, 'session-closed');
@@ -2083,7 +2270,7 @@ export class CodexRunner {
         }
     }
     resolveSessionFile(agentSessionId, _projectPath) {
-        // Codex session 文件: ~/.codex/sessions/YYYY/MM/DD/rollout-*-{threadId}.jsonl
+        // Codex sessions are shared with the local Codex Desktop installation.
         const sessionsDir = path.join(os.homedir(), '.codex', 'sessions');
         if (!fs.existsSync(sessionsDir))
             return null;
@@ -2145,7 +2332,7 @@ export class CodexRunner {
                 if (!this.isThreadNotFoundError(error))
                     throw error;
                 logger.info(`[CodexRunner] Compact thread not loaded, resuming before compact: ${agentSessionId}`);
-                const compactModel = modelOverride?.model || this.model;
+                const compactModel = stripContextWindowSuffix(modelOverride?.model || this.model);
                 const compactEffort = modelOverride?.effortMode === 'model_default'
                     ? undefined
                     : modelOverride?.effort ?? this.effort;
@@ -2165,7 +2352,7 @@ export class CodexRunner {
                     approvalPolicy: compactPolicy,
                     approvalsReviewer: 'user',
                     ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier), this.buildLifecycleLockdownConfig(compactMode)), compactMode),
+                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier, undefined, agentSessionId), this.buildLifecycleLockdownConfig(compactMode)), compactMode),
                 });
                 this.markThreadSubscribed(appServer, agentSessionId);
                 this.threadProjectPaths.set(agentSessionId, path.resolve(_projectPath));
@@ -2274,10 +2461,14 @@ export class CodexRunner {
         }
         return false;
     }
+    codexHomeDir() {
+        return process.env.CODEX_HOME || path.join(process.env.HOME || os.homedir(), '.codex');
+    }
     findCodexSessionFile(threadId) {
-        const root = process.env.CODEX_HOME
-            ? path.join(process.env.CODEX_HOME, 'sessions')
-            : path.join(process.env.HOME || os.homedir(), '.codex', 'sessions');
+        return this.findRolloutFile(path.join(this.codexHomeDir(), 'sessions'), threadId)
+            ?? this.findRolloutFile(path.join(this.codexHomeDir(), 'archived_sessions'), threadId);
+    }
+    findRolloutFile(root, threadId) {
         const stack = [root];
         let newest;
         while (stack.length > 0) {
@@ -2309,6 +2500,101 @@ export class CodexRunner {
         }
         return newest?.path;
     }
+    // ── Managed-hook thread credentials ─────────────────────────────────
+    // The Windows managed hook is machine-wide, so unmanaged Codex processes
+    // also reach it. Credentials let the hook tell EvolCore-owned threads
+    // (policy enforced) apart from unmanaged ones (allowed unconditionally).
+    // They follow the thread (not the daemon process) so a daemon restart does
+    // not strand a resumable thread: the token file is re-read on resume, and
+    // it is removed lazily once the rollout file itself disappears.
+    threadCredentialsDir() {
+        const aid = this.resolvedConfig.agentAid;
+        if (!aid)
+            return undefined;
+        return path.join(agentSessionsDir(aid), 'codex-tokens');
+    }
+    threadCredentialPath(threadId) {
+        const dir = this.threadCredentialsDir();
+        return dir ? path.join(dir, `${encodeURIComponent(threadId)}.json`) : undefined;
+    }
+    /** Issue or re-read this agent's credential for a thread. */
+    ensureThreadCredential(threadId) {
+        const cached = this.threadCredentials.get(threadId);
+        if (cached)
+            return cached;
+        const file = this.threadCredentialPath(threadId);
+        if (!file)
+            return undefined;
+        try {
+            const record = JSON.parse(fs.readFileSync(file, 'utf8'));
+            if (record && typeof record.token === 'string' && record.token && record.threadId === threadId) {
+                this.threadCredentials.set(threadId, record.token);
+                return record.token;
+            }
+        }
+        catch { /* missing or unreadable: fall through to issuance */ }
+        const token = randomBytes(32).toString('hex');
+        const record = {
+            token,
+            threadId,
+            createdAt: new Date().toISOString(),
+            rolloutPath: this.findCodexSessionFile(threadId),
+        };
+        try {
+            fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+            fs.writeFileSync(file, JSON.stringify(record, null, 2), { mode: 0o600 });
+            this.threadCredentials.set(threadId, token);
+            return token;
+        }
+        catch (error) {
+            logger.warn(`[CodexRunner] failed to persist thread credential: thread=${threadId} error=${error instanceof Error ? error.message : String(error)}`);
+            return undefined;
+        }
+    }
+    /**
+     * Validate a credential presented by the managed hook. Returns the matched
+     * threadId when this runner issued the token; undefined otherwise. Token
+     * records whose rollout file has disappeared are pruned lazily.
+     */
+    validateThreadCredential(threadId, token) {
+        const expected = this.ensureThreadCredentialLoaded(threadId);
+        if (!expected || expected !== token)
+            return false;
+        const rollout = this.findCodexSessionFile(threadId);
+        if (!rollout) {
+            // The thread's rollout is gone: nothing left to protect, drop the record.
+            this.dropThreadCredential(threadId);
+            return false;
+        }
+        return true;
+    }
+    ensureThreadCredentialLoaded(threadId) {
+        const cached = this.threadCredentials.get(threadId);
+        if (cached)
+            return cached;
+        const file = this.threadCredentialPath(threadId);
+        if (!file)
+            return undefined;
+        try {
+            const record = JSON.parse(fs.readFileSync(file, 'utf8'));
+            if (record && typeof record.token === 'string' && record.token && record.threadId === threadId) {
+                this.threadCredentials.set(threadId, record.token);
+                return record.token;
+            }
+        }
+        catch { /* absent or unreadable */ }
+        return undefined;
+    }
+    dropThreadCredential(threadId) {
+        this.threadCredentials.delete(threadId);
+        const file = this.threadCredentialPath(threadId);
+        if (!file)
+            return;
+        try {
+            fs.rmSync(file, { force: true });
+        }
+        catch { /* best effort */ }
+    }
     async forkSession(agentSessionId, projectPath, title) {
         const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'fork');
         try {
@@ -2597,6 +2883,31 @@ export class CodexRunner {
                 ? 'FileChange'
                 : 'Bash';
         const toolInput = this.buildPermissionInput(request.method, params);
+        const approvalCallId = typeof (params.itemId ?? params.item_id ?? params.callId ?? params.call_id) === 'string'
+            ? String(params.itemId ?? params.item_id ?? params.callId ?? params.call_id)
+            : undefined;
+        const approvalRequestId = request.id !== undefined
+            ? String(request.id)
+            : approvalCallId ?? `codex-approval-${crypto.randomUUID()}`;
+        this.approvalLifecycleIds.set(request, approvalRequestId);
+        const approvalContext = this.permissionContexts.get(sessionKey);
+        auditPermissionLifecycle({
+            phase: 'request',
+            requestId: approvalRequestId,
+            callId: approvalCallId,
+            correlationId: approvalCallId,
+            sessionId: sessionKey,
+            agentAid: approvalContext?.selfAid,
+            agentName: approvalContext?.agentName,
+            permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+            toolName,
+            decision: 'pending',
+            decisionSource: 'approval',
+            role: approvalContext?.role,
+            taskId: approvalContext?.taskId,
+            summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+            approvalMethod: request.method,
+        });
         // A trusted fullaccess run has already been explicitly authorized by the
         // daemon owner. Do not route its approvals through ordinary capability,
         // workspace, or unattended-trigger policy checks.
@@ -2834,6 +3145,49 @@ export class CodexRunner {
             reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
             parseFailure,
         });
+        const lifecycleRequestId = request.id !== undefined
+            ? String(request.id)
+            : this.approvalLifecycleIds.get(request)
+                ?? callId
+                ?? `codex-approval-${crypto.randomUUID()}`;
+        auditPermissionLifecycle({
+            phase: 'response',
+            requestId: lifecycleRequestId,
+            callId,
+            correlationId: callId,
+            sessionId: sessionKey,
+            agentAid: context?.selfAid,
+            agentName: context?.agentName,
+            permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+            toolName,
+            decision,
+            decisionSource,
+            policyCode,
+            reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
+            role: context?.role,
+            taskId: context?.taskId,
+            summary: auditSummary,
+            approvalMethod: request.method,
+        });
+        auditPermissionLifecycle({
+            phase: 'final',
+            requestId: lifecycleRequestId,
+            callId,
+            correlationId: callId,
+            sessionId: sessionKey,
+            agentAid: context?.selfAid,
+            agentName: context?.agentName,
+            permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+            toolName,
+            decision,
+            decisionSource,
+            policyCode,
+            reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
+            role: context?.role,
+            taskId: context?.taskId,
+            summary: auditSummary,
+            approvalMethod: request.method,
+        });
         logger.info(`[CodexRunner] app-server approval audit ${JSON.stringify({
             requestId: request.id !== undefined ? String(request.id) : undefined,
             ...(callId ? { callId, correlationId: callId } : {}),
@@ -3924,26 +4278,37 @@ export class CodexRunner {
             for await (const notification of notifications) {
                 if (!this.activeAbortControllers.has(sessionId))
                     break;
-                if (!state.committed && notification.method === 'turn/completed') {
-                    const turn = notification.params?.turn ?? {};
-                    if (turn.status === 'completed') {
-                        const committed = await state.commitProvisional?.();
-                        if (!committed) {
-                            const staleError = new Error('Codex provisional thread was superseded before commit');
-                            staleError.code = 'RUNNER_START_SUPERSEDED';
-                            throw staleError;
-                        }
-                        state.committed = true;
-                        if (!sessionIdEmitted) {
-                            sessionIdEmitted = true;
-                            yield { type: 'session_id', sessionId: state.threadId };
-                        }
+                if (!state.committed && !state.persistenceFinalized) {
+                    const terminal = notification.method === 'turn/completed';
+                    const committed = await state.confirmProvisional?.(terminal ? 250 : 0) ?? false;
+                    if (committed && !sessionIdEmitted) {
+                        sessionIdEmitted = true;
+                        yield { type: 'session_id', sessionId: state.threadId };
+                    }
+                    else if (terminal && !committed) {
+                        state.persistenceFinalized = true;
+                        const persistenceError = new Error(`Codex turn completed before its rollout became recoverable: thread=${state.threadId} turn=${state.turnId ?? '<unknown>'}`);
+                        persistenceError.code = 'CODEX_TURN_PERSISTENCE_UNCONFIRMED';
+                        throw persistenceError;
                     }
                 }
                 yield* this.mapAppServerNotification(notification, sessionId, state);
             }
         }
         finally {
+            if (!state.committed && !state.persistenceFinalized && state.confirmProvisional) {
+                try {
+                    // Do not let an interrupt wait for persistence that did not exist at
+                    // cancellation time. A zero-wait check still captures a rollout
+                    // that was already durable before the stream was closed.
+                    await state.confirmProvisional(0);
+                }
+                catch (error) {
+                    logger.debug(`[CodexRunner] provisional thread rejected during final persistence check: `
+                        + `session=${sessionId} thread=${state.threadId} error=${error instanceof Error ? error.message : String(error)}`);
+                }
+                state.persistenceFinalized = true;
+            }
             unsubscribe();
             await this.releaseThreadSubscription(appServer, state.threadId, 'turn-finished');
             if (this.activeAbortControllers.get(sessionId) === controller) {
@@ -3990,6 +4355,15 @@ export class CodexRunner {
                 }
                 break;
             }
+            // Reasoning notifications are provider-internal liveness signals.
+            // Do not expose their content; the ResponseEngine consumes the heartbeat
+            // solely to reset the idle monitor.
+            case 'item/reasoning/textDelta':
+            case 'item/reasoning/summaryTextDelta':
+            case 'item/reasoning/summaryPartAdded': {
+                yield { type: 'heartbeat', source: 'reasoning' };
+                break;
+            }
             case 'item/completed': {
                 const item = params.item;
                 if (item?.id)
@@ -4601,12 +4975,17 @@ export class CodexRunner {
         }
     }
     managedTempInstruction(sessionId) {
-        if (!this.ensureSessionTempDir(sessionId))
+        const managedTempDir = this.ensureSessionTempDir(sessionId);
+        if (!managedTempDir)
             return undefined;
-        return '临时文件必须使用环境变量 `$TMPDIR`。它指向当前 EvolCore 会话的受管临时工作区；不要直接使用 `/tmp`，也不要使用其他会话的临时目录。当前是可持久化 thread 的恢复轮次，早先上下文中的 `/tmp/evolcore-codex-*` 绝对路径可能已经失效；不要重用旧路径。若文件不存在，请先在当前 `$TMPDIR` 重新创建，再继续执行后续 `ec` 命令。';
+        return `临时文件必须使用环境变量 \`$TMPDIR\`。当前值是 \`${managedTempDir}\`，它是当前 EvolCore 会话唯一允许的临时工作区；不要直接使用 \`/tmp\`，也不要使用其他会话的临时目录。当前是可持久化 thread 的恢复轮次，早先上下文中的 \`/tmp/evolcore-codex-*\` 绝对路径可能已经失效；不要重用旧路径。若文件不存在，请先在当前 \`$TMPDIR\` 重新创建，再继续执行后续 \`ec\` 命令。`;
     }
-    buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrier, taskDelegationToken) {
+    buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrier, taskDelegationToken, threadId) {
         const managedTempDir = this.ensureSessionTempDir(sessionId);
+        // The managed-hook credential rides the thread's shell environment so the
+        // PreToolUse hook can prove the call belongs to an EvolCore-owned thread.
+        // It follows the thread (start AND resume) rather than the daemon process.
+        const sessionToken = threadId ? this.ensureThreadCredential(threadId) : undefined;
         return {
             shell_environment_policy: {
                 set: {
@@ -4617,6 +4996,7 @@ export class CodexRunner {
                     ...(taskDelegationToken || delegationCarrier
                         ? { [AGENT_DELEGATION_TOKEN_ENV]: taskDelegationToken ?? delegationCarrier }
                         : {}),
+                    ...(sessionToken ? { [CODEX_SESSION_TOKEN_ENV]: sessionToken } : {}),
                     ...(managedTempDir ? { TMPDIR: managedTempDir } : {}),
                 },
             },
@@ -4672,6 +5052,7 @@ export class CodexRunner {
             this.appServerClient?.close(),
             this.fullAccessAppServerClient?.close(),
         ]);
+        this.codexSessionFileAdapter.close();
         this.appServerClient = null;
         this.fullAccessAppServerClient = null;
     }
@@ -4682,8 +5063,6 @@ export class CodexAgentPlugin {
     isEnabled(agent) {
         if (!agent.config.baseagents?.codex)
             return false;
-        if (!isCodexAppServerAvailable())
-            return false;
         try {
             const override = agent.config.baseagents.codex;
             const syntheticConfig = { agents: { codex: override } };
@@ -4694,8 +5073,8 @@ export class CodexAgentPlugin {
             return false;
         }
     }
-    createAgent(agent, callbacks) {
-        const availability = getCodexAppServerAvailability();
+    async createAgent(agent, callbacks) {
+        const availability = await getCodexAppServerAvailabilityAsync();
         if (!availability.available) {
             throw new Error(availability.reason || 'Missing codex CLI with app-server');
         }